<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[204824] releases/WebKitGTK/webkit-2.12</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/204824">204824</a></dd>
<dt>Author</dt> <dd>carlosgc@webkit.org</dd>
<dt>Date</dt> <dd>2016-08-23 05:53:59 -0700 (Tue, 23 Aug 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/199017">r199017</a> - Regression(<a href="http://trac.webkit.org/projects/webkit/changeset/196145">r196145</a>): Crash in getOwnPropertyDescriptor on http://www.history.com/shows/vikings
https://bugs.webkit.org/show_bug.cgi?id=156136
&lt;rdar://problem/25410767&gt;

Reviewed by Ryosuke Niwa.

Source/JavaScriptCore:

Add a few more identifiers for using in the generated bindings.

* runtime/CommonIdentifiers.h:

Source/WebCore:

The page was crashing when doing the following:
Object.getOwnPropertyDescriptor(window, &quot;indexedDB&quot;)

getOwnPropertyDescriptor() expected getDirect() to return a CustomGetterSetter for
CustomAccessors but it was not the case for window.indexedDB. The reason was that
window.indexedDB was a special property, which is not part of the static table but
returned by GetOwnPropertySlot() if IndexedDB feature is enabled. This weirdness
was due to our bindings generator not having proper support for [EnabledAtRuntime]
properties on Window.

This patch adds support for [EnabledAtRuntime] properties on Window by omitting
these properties from the static property table and then setting them at runtime
in JSDOMWindow::finishCreation() if the corresponding feature is enabled.
window.indexedDB now looks like a regular property when IndexedDB is enabled
and getOwnPropertyDescriptor() works as expected for this property.

Test: storage/indexeddb/indexeddb-getownpropertyDescriptor.html

* Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
(WebCore::DOMWindowIndexedDatabase::indexedDB):
* Modules/indexeddb/DOMWindowIndexedDatabase.h:
The generated bindings pass DOMWindow by reference instead of pointer so update
the implementation accordingly.

* Modules/indexeddb/DOMWindowIndexedDatabase.idl:
Add 'indexedDB' and 'webkitIndexedDB' properties and mark them as
[EnabledAtRuntime]. Now that the bindings generator correctly handles
[EnabledAtRuntime] properties on the Window, there is no need to
custom-handle them in JSDOMWindowCustom.

* bindings/js/JSDOMWindowCustom.cpp:
Drop custom handling for 'indexedDB' and 'webkitIndexedDB' properties
in getOwnPropertySlot(). The generated bindings code now makes sure to
only set those properties on the Window if IndexedDB is enabled so we
can let the regular code path look up those properties.

* bindings/scripts/CodeGeneratorJS.pm:
(GetJSCAttributesForAttribute):
(GenerateHeader):
(GeneratePropertiesHashTable):
(GenerateImplementation):
Add support for [EnabledAtRuntime] properties on DOMWindow. For such
properties, we do the following:
1. Omit them from the static property table
2. In JSDOMWindow::finishCreation(), dynamically add those properties
   at runtime if the corresponding feature is enabled.

Note that this works for constructors as well.

* inspector/InspectorIndexedDBAgent.cpp:
(WebCore::assertIDBFactory):
Pass Window by reference instead of pointer.

LayoutTests:

Add a layout test to confirm that calling Object.getOwnPropertyDescriptor(window, &quot;indexedDB&quot;)
does not crash and works as expected.

* storage/indexeddb/indexeddb-getownpropertyDescriptor-expected.txt: Added.
* storage/indexeddb/indexeddb-getownpropertyDescriptor.html: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsChangeLog">releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceJavaScriptCoreChangeLog">releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceJavaScriptCoreruntimeCommonIdentifiersh">releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore/runtime/CommonIdentifiers.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoreChangeLog">releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoreModulesindexeddbDOMWindowIndexedDatabasecpp">releases/WebKitGTK/webkit-2.12/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoreModulesindexeddbDOMWindowIndexedDatabaseh">releases/WebKitGTK/webkit-2.12/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoreModulesindexeddbDOMWindowIndexedDatabaseidl">releases/WebKitGTK/webkit-2.12/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.idl</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCorebindingsjsJSDOMWindowCustomcpp">releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCorebindingsscriptsCodeGeneratorJSpm">releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoreinspectorInspectorIndexedDBAgentcpp">releases/WebKitGTK/webkit-2.12/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsstorageindexeddbindexeddbgetownpropertyDescriptorexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/storage/indexeddb/indexeddb-getownpropertyDescriptor-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsstorageindexeddbindexeddbgetownpropertyDescriptorhtml">releases/WebKitGTK/webkit-2.12/LayoutTests/storage/indexeddb/indexeddb-getownpropertyDescriptor.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit212LayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog (204823 => 204824)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog        2016-08-23 12:30:41 UTC (rev 204823)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog        2016-08-23 12:53:59 UTC (rev 204824)
</span><span class="lines">@@ -1,3 +1,17 @@
</span><ins>+2016-04-04  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Regression(r196145): Crash in getOwnPropertyDescriptor on http://www.history.com/shows/vikings
+        https://bugs.webkit.org/show_bug.cgi?id=156136
+        &lt;rdar://problem/25410767&gt;
+
+        Reviewed by Ryosuke Niwa.
+
+        Add a layout test to confirm that calling Object.getOwnPropertyDescriptor(window, &quot;indexedDB&quot;)
+        does not crash and works as expected.
+
+        * storage/indexeddb/indexeddb-getownpropertyDescriptor-expected.txt: Added.
+        * storage/indexeddb/indexeddb-getownpropertyDescriptor.html: Added.
+
</ins><span class="cx"> 2016-08-01  Antti Koivisto  &lt;antti@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         REGRESSION (r196383): Drop down CSS menus not working on cnet.com, apmex.com
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsstorageindexeddbindexeddbgetownpropertyDescriptorexpectedtxt"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.12/LayoutTests/storage/indexeddb/indexeddb-getownpropertyDescriptor-expected.txt (0 => 204824)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/storage/indexeddb/indexeddb-getownpropertyDescriptor-expected.txt                                (rev 0)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/storage/indexeddb/indexeddb-getownpropertyDescriptor-expected.txt        2016-08-23 12:53:59 UTC (rev 204824)
</span><span class="lines">@@ -0,0 +1,14 @@
</span><ins>+Tests using getOwnPropertyDescriptor() on window.indexedDB
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+desc = Object.getOwnPropertyDescriptor(window, 'indexedDB')
+PASS desc.get is an instance of Function
+PASS desc.set is undefined.
+PASS desc.enumerable is true
+PASS desc.configurable is true
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsstorageindexeddbindexeddbgetownpropertyDescriptorhtml"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.12/LayoutTests/storage/indexeddb/indexeddb-getownpropertyDescriptor.html (0 => 204824)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/storage/indexeddb/indexeddb-getownpropertyDescriptor.html                                (rev 0)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/storage/indexeddb/indexeddb-getownpropertyDescriptor.html        2016-08-23 12:53:59 UTC (rev 204824)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/js-test.js&quot;&gt;&lt;/script&gt;
+&lt;script&gt;
+description(&quot;Tests using getOwnPropertyDescriptor() on window.indexedDB&quot;);
+
+evalAndLog(&quot;desc = Object.getOwnPropertyDescriptor(window, 'indexedDB')&quot;);
+shouldBeType(&quot;desc.get&quot;, &quot;Function&quot;);
+shouldBeUndefined(&quot;desc.set&quot;);
+shouldBeTrue(&quot;desc.enumerable&quot;);
+shouldBeTrue(&quot;desc.configurable&quot;);
+&lt;/script&gt;
+&lt;/body&gt;
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore/ChangeLog (204823 => 204824)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore/ChangeLog        2016-08-23 12:30:41 UTC (rev 204823)
+++ releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore/ChangeLog        2016-08-23 12:53:59 UTC (rev 204824)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2016-04-04  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Regression(r196145): Crash in getOwnPropertyDescriptor on http://www.history.com/shows/vikings
+        https://bugs.webkit.org/show_bug.cgi?id=156136
+        &lt;rdar://problem/25410767&gt;
+
+        Reviewed by Ryosuke Niwa.
+
+        Add a few more identifiers for using in the generated bindings.
+
+        * runtime/CommonIdentifiers.h:
+
</ins><span class="cx"> 2016-02-21  Skachkov Oleksandr  &lt;gskachkov@gmail.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Remove arrowfunction test cases that rely on arguments variable in jsc
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceJavaScriptCoreruntimeCommonIdentifiersh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore/runtime/CommonIdentifiers.h (204823 => 204824)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore/runtime/CommonIdentifiers.h        2016-08-23 12:30:41 UTC (rev 204823)
+++ releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore/runtime/CommonIdentifiers.h        2016-08-23 12:53:59 UTC (rev 204824)
</span><span class="lines">@@ -28,18 +28,37 @@
</span><span class="cx"> // MarkedArgumentBuffer of property names, passed to a macro so we can do set them up various
</span><span class="cx"> // ways without repeating the list.
</span><span class="cx"> #define JSC_COMMON_IDENTIFIERS_EACH_PROPERTY_NAME(macro) \
</span><ins>+    macro(AnimationTimeline) \
</ins><span class="cx">     macro(Array) \
</span><span class="cx">     macro(ArrayBuffer) \
</span><span class="cx">     macro(ArrayIterator) \
</span><ins>+    macro(Audio) \
</ins><span class="cx">     macro(BYTES_PER_ELEMENT) \
</span><span class="cx">     macro(Boolean) \
</span><span class="cx">     macro(Collator) \
</span><span class="cx">     macro(Date) \
</span><span class="cx">     macro(DateTimeFormat) \
</span><ins>+    macro(DocumentTimeline) \
</ins><span class="cx">     macro(Error) \
</span><span class="cx">     macro(EvalError) \
</span><span class="cx">     macro(Function) \
</span><ins>+    macro(Gamepad) \
+    macro(GamepadButton) \
+    macro(GamepadEvent) \
</ins><span class="cx">     macro(GeneratorFunction) \
</span><ins>+    macro(HTMLAudioElement) \
+    macro(HTMLSlotElement) \
+    macro(IDBCursor) \
+    macro(IDBCursorWithValue) \
+    macro(IDBDatabase) \
+    macro(IDBFactory) \
+    macro(IDBIndex) \
+    macro(IDBKeyRange) \
+    macro(IDBObjectStore) \
+    macro(IDBOpenDBRequest) \
+    macro(IDBRequest) \
+    macro(IDBTransaction) \
+    macro(IDBVersionChangeEvent) \
</ins><span class="cx">     macro(Infinity) \
</span><span class="cx">     macro(Intl) \
</span><span class="cx">     macro(JSON) \
</span><span class="lines">@@ -59,6 +78,7 @@
</span><span class="cx">     macro(RegExp) \
</span><span class="cx">     macro(Set)\
</span><span class="cx">     macro(SetIterator)\
</span><ins>+    macro(ShadowRoot) \
</ins><span class="cx">     macro(String) \
</span><span class="cx">     macro(Symbol) \
</span><span class="cx">     macro(SyntaxError) \
</span><span class="lines">@@ -67,6 +87,7 @@
</span><span class="cx">     macro(UTC) \
</span><span class="cx">     macro(WeakMap)\
</span><span class="cx">     macro(WeakSet)\
</span><ins>+    macro(WebSocket) \
</ins><span class="cx">     macro(__defineGetter__) \
</span><span class="cx">     macro(__defineSetter__) \
</span><span class="cx">     macro(__lookupGetter__) \
</span><span class="lines">@@ -216,6 +237,14 @@
</span><span class="cx">     macro(valueOf) \
</span><span class="cx">     macro(values) \
</span><span class="cx">     macro(webkit) \
</span><ins>+    macro(webkitIDBCursor) \
+    macro(webkitIDBDatabase) \
+    macro(webkitIDBFactory) \
+    macro(webkitIDBIndex) \
+    macro(webkitIDBKeyRange) \
+    macro(webkitIDBObjectStore) \
+    macro(webkitIDBRequest) \
+    macro(webkitIDBTransaction) \
</ins><span class="cx">     macro(webkitIndexedDB) \
</span><span class="cx">     macro(weekday) \
</span><span class="cx">     macro(window) \
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog (204823 => 204824)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog        2016-08-23 12:30:41 UTC (rev 204823)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog        2016-08-23 12:53:59 UTC (rev 204824)
</span><span class="lines">@@ -1,3 +1,64 @@
</span><ins>+2016-04-04  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Regression(r196145): Crash in getOwnPropertyDescriptor on http://www.history.com/shows/vikings
+        https://bugs.webkit.org/show_bug.cgi?id=156136
+        &lt;rdar://problem/25410767&gt;
+
+        Reviewed by Ryosuke Niwa.
+
+        The page was crashing when doing the following:
+        Object.getOwnPropertyDescriptor(window, &quot;indexedDB&quot;)
+
+        getOwnPropertyDescriptor() expected getDirect() to return a CustomGetterSetter for
+        CustomAccessors but it was not the case for window.indexedDB. The reason was that
+        window.indexedDB was a special property, which is not part of the static table but
+        returned by GetOwnPropertySlot() if IndexedDB feature is enabled. This weirdness
+        was due to our bindings generator not having proper support for [EnabledAtRuntime]
+        properties on Window.
+
+        This patch adds support for [EnabledAtRuntime] properties on Window by omitting
+        these properties from the static property table and then setting them at runtime
+        in JSDOMWindow::finishCreation() if the corresponding feature is enabled.
+        window.indexedDB now looks like a regular property when IndexedDB is enabled
+        and getOwnPropertyDescriptor() works as expected for this property.
+
+        Test: storage/indexeddb/indexeddb-getownpropertyDescriptor.html
+
+        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
+        (WebCore::DOMWindowIndexedDatabase::indexedDB):
+        * Modules/indexeddb/DOMWindowIndexedDatabase.h:
+        The generated bindings pass DOMWindow by reference instead of pointer so update
+        the implementation accordingly.
+
+        * Modules/indexeddb/DOMWindowIndexedDatabase.idl:
+        Add 'indexedDB' and 'webkitIndexedDB' properties and mark them as
+        [EnabledAtRuntime]. Now that the bindings generator correctly handles
+        [EnabledAtRuntime] properties on the Window, there is no need to
+        custom-handle them in JSDOMWindowCustom.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        Drop custom handling for 'indexedDB' and 'webkitIndexedDB' properties
+        in getOwnPropertySlot(). The generated bindings code now makes sure to
+        only set those properties on the Window if IndexedDB is enabled so we
+        can let the regular code path look up those properties.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GetJSCAttributesForAttribute):
+        (GenerateHeader):
+        (GeneratePropertiesHashTable):
+        (GenerateImplementation):
+        Add support for [EnabledAtRuntime] properties on DOMWindow. For such
+        properties, we do the following:
+        1. Omit them from the static property table
+        2. In JSDOMWindow::finishCreation(), dynamically add those properties
+           at runtime if the corresponding feature is enabled.
+
+        Note that this works for constructors as well.
+
+        * inspector/InspectorIndexedDBAgent.cpp:
+        (WebCore::assertIDBFactory):
+        Pass Window by reference instead of pointer.
+
</ins><span class="cx"> 2016-06-16  Ting-Wei Lan  &lt;lantw44@gmail.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Include cstdlib before using std::atexit
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoreModulesindexeddbDOMWindowIndexedDatabasecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.cpp (204823 => 204824)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.cpp        2016-08-23 12:30:41 UTC (rev 204823)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.cpp        2016-08-23 12:53:59 UTC (rev 204824)
</span><span class="lines">@@ -93,9 +93,9 @@
</span><span class="cx">     DOMWindowProperty::willDetachGlobalObjectFromFrame();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-IDBFactory* DOMWindowIndexedDatabase::indexedDB(DOMWindow* window)
</del><ins>+IDBFactory* DOMWindowIndexedDatabase::indexedDB(DOMWindow&amp; window)
</ins><span class="cx"> {
</span><del>-    return from(window)-&gt;indexedDB();
</del><ins>+    return from(&amp;window)-&gt;indexedDB();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> IDBFactory* DOMWindowIndexedDatabase::indexedDB()
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoreModulesindexeddbDOMWindowIndexedDatabaseh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.h (204823 => 204824)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.h        2016-08-23 12:30:41 UTC (rev 204823)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.h        2016-08-23 12:53:59 UTC (rev 204824)
</span><span class="lines">@@ -44,7 +44,7 @@
</span><span class="cx"> 
</span><span class="cx">     static DOMWindowIndexedDatabase* from(DOMWindow*);
</span><span class="cx"> 
</span><del>-    static IDBFactory* indexedDB(DOMWindow*);
</del><ins>+    static IDBFactory* indexedDB(DOMWindow&amp;);
</ins><span class="cx"> 
</span><span class="cx">     virtual void disconnectFrameForDocumentSuspension() override;
</span><span class="cx">     virtual void reconnectFrameFromDocumentSuspension(Frame*) override;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoreModulesindexeddbDOMWindowIndexedDatabaseidl"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.idl (204823 => 204824)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.idl        2016-08-23 12:30:41 UTC (rev 204823)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.idl        2016-08-23 12:53:59 UTC (rev 204824)
</span><span class="lines">@@ -27,6 +27,7 @@
</span><span class="cx"> [
</span><span class="cx">     Conditional=INDEXED_DATABASE,
</span><span class="cx"> ] partial interface DOMWindow {
</span><del>-    // This space is intentionally left blank.
</del><ins>+    [EnabledAtRuntime=IndexedDB] readonly attribute IDBFactory indexedDB;
+    [EnabledAtRuntime=IndexedDB, ImplementedAs=indexedDB] readonly attribute IDBFactory webkitIndexedDB;
</ins><span class="cx"> };
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCorebindingsjsJSDOMWindowCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (204823 => 204824)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp        2016-08-23 12:30:41 UTC (rev 204823)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp        2016-08-23 12:53:59 UTC (rev 204824)
</span><span class="lines">@@ -76,21 +76,6 @@
</span><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-#if ENABLE(INDEXED_DATABASE)
-static EncodedJSValue jsDOMWindowIndexedDB(ExecState* exec, EncodedJSValue thisValue, PropertyName)
-{
-    UNUSED_PARAM(exec);
-    auto* castedThis = toJSDOMWindow(JSValue::decode(thisValue));
-    if (!RuntimeEnabledFeatures::sharedFeatures().indexedDBEnabled())
-        return JSValue::encode(jsUndefined());
-    if (!castedThis || !BindingSecurity::shouldAllowAccessToDOMWindow(exec, castedThis-&gt;wrapped()))
-        return JSValue::encode(jsUndefined());
-    auto&amp; impl = castedThis-&gt;wrapped();
-    JSValue result = toJS(exec, castedThis-&gt;globalObject(), WTF::getPtr(DOMWindowIndexedDatabase::indexedDB(&amp;impl)));
-    return JSValue::encode(result);
-}
-#endif
-
</del><span class="cx"> static bool jsDOMWindowGetOwnPropertySlotRestrictedAccess(JSDOMWindow* thisObject, Frame* frame, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot, String&amp; errorMessage)
</span><span class="cx"> {
</span><span class="cx">     // Allow access to toString() cross-domain, but always Object.prototype.toString.
</span><span class="lines">@@ -263,16 +248,6 @@
</span><span class="cx">     if (getStaticPropertySlot&lt;JSDOMWindow, Base&gt;(exec, *JSDOMWindow::info()-&gt;staticPropHashTable, thisObject, propertyName, slot))
</span><span class="cx">         return true;
</span><span class="cx"> 
</span><del>-#if ENABLE(INDEXED_DATABASE)
-    // FIXME: With generated JS bindings built on static property tables there is no way to
-    // completely remove a generated property at runtime. So to completely disable IndexedDB
-    // at runtime we have to not generate these accessors and have to handle them specially here.
-    // Once https://webkit.org/b/145669 is resolved, they can once again be auto generated.
-    if (RuntimeEnabledFeatures::sharedFeatures().indexedDBEnabled() &amp;&amp; (propertyName == exec-&gt;propertyNames().indexedDB || propertyName == exec-&gt;propertyNames().webkitIndexedDB)) {
-        slot.setCustom(thisObject, DontDelete | ReadOnly | CustomAccessor, jsDOMWindowIndexedDB);
-        return true;
-    }
-#endif
</del><span class="cx"> #if ENABLE(USER_MESSAGE_HANDLERS)
</span><span class="cx">     if (propertyName == exec-&gt;propertyNames().webkit &amp;&amp; thisObject-&gt;wrapped().shouldHaveWebKitNamespaceForWorld(thisObject-&gt;world())) {
</span><span class="cx">         slot.setCacheableCustom(thisObject, DontDelete | ReadOnly, jsDOMWindowWebKit);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (204823 => 204824)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2016-08-23 12:30:41 UTC (rev 204823)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2016-08-23 12:53:59 UTC (rev 204824)
</span><span class="lines">@@ -730,6 +730,23 @@
</span><span class="cx">     return 0;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+sub GetJSCAttributesForAttribute
+{
+    my $interface = shift;
+    my $attribute = shift;
+
+    my @specials = ();
+    push(@specials, &quot;DontDelete&quot;) if IsUnforgeable($interface, $attribute);
+
+    # As per Web IDL specification, constructor properties on the ECMAScript global object should not be enumerable.
+    my $is_global_constructor = $attribute-&gt;signature-&gt;type =~ /Constructor$/;
+    push(@specials, &quot;DontEnum&quot;) if ($attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;NotEnumerable&quot;} || $is_global_constructor);
+    push(@specials, &quot;ReadOnly&quot;) if IsReadonly($attribute);
+    push(@specials, &quot;CustomAccessor&quot;) unless $is_global_constructor or IsJSBuiltin($interface, $attribute);
+    push(@specials, &quot;Accessor | Builtin&quot;) if  IsJSBuiltin($interface, $attribute);
+    return (@specials &gt; 0) ? join(&quot; | &quot;, @specials) : &quot;0&quot;;
+}
+
</ins><span class="cx"> sub GetIndexedGetterFunction
</span><span class="cx"> {
</span><span class="cx">     my $interface = shift;
</span><span class="lines">@@ -1225,6 +1242,7 @@
</span><span class="cx">     # Constructor
</span><span class="cx">     if ($interfaceName eq &quot;DOMWindow&quot;) {
</span><span class="cx">         push(@headerContent, &quot;    $className(JSC::VM&amp;, JSC::Structure*, Ref&lt;$implType&gt;&amp;&amp;, JSDOMWindowShell*);\n&quot;);
</span><ins>+        push(@headerContent, &quot;    void finishCreation(JSC::VM&amp;, JSDOMWindowShell*);\n&quot;);
</ins><span class="cx">     } elsif ($codeGenerator-&gt;InheritsInterface($interface, &quot;WorkerGlobalScope&quot;)) {
</span><span class="cx">         push(@headerContent, &quot;    $className(JSC::VM&amp;, JSC::Structure*, Ref&lt;$implType&gt;&amp;&amp;);\n&quot;);
</span><span class="cx">     } elsif (!NeedsImplementationClass($interface)) {
</span><span class="lines">@@ -1387,19 +1405,17 @@
</span><span class="cx">     foreach my $attribute (@{$interface-&gt;attributes}) {
</span><span class="cx">         next if ($attribute-&gt;isStatic);
</span><span class="cx">         next if AttributeShouldBeOnInstance($interface, $attribute) != $isInstance;
</span><ins>+
+        # DOMWindow adds RuntimeEnabled attributes after creation so do not add them to the static table.
+        if ($interfaceName eq &quot;DOMWindow&quot; &amp;&amp; $attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;EnabledAtRuntime&quot;}) {
+            $propertyCount -= 1;
+            next;
+        }
+
</ins><span class="cx">         my $name = $attribute-&gt;signature-&gt;name;
</span><span class="cx">         push(@$hashKeys, $name);
</span><span class="cx"> 
</span><del>-        my @specials = ();
-        push(@specials, &quot;DontDelete&quot;) if IsUnforgeable($interface, $attribute);
-
-        # As per Web IDL specification, constructor properties on the ECMAScript global object should not be enumerable.
-        my $is_global_constructor = $attribute-&gt;signature-&gt;type =~ /Constructor$/;
-        push(@specials, &quot;DontEnum&quot;) if ($attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;NotEnumerable&quot;} || $is_global_constructor);
-        push(@specials, &quot;ReadOnly&quot;) if IsReadonly($attribute);
-        push(@specials, &quot;CustomAccessor&quot;) unless $is_global_constructor or IsJSBuiltin($interface, $attribute);
-        push(@specials, &quot;Accessor | Builtin&quot;) if  IsJSBuiltin($interface, $attribute);
-        my $special = (@specials &gt; 0) ? join(&quot; | &quot;, @specials) : &quot;0&quot;;
</del><ins>+        my $special = GetJSCAttributesForAttribute($interface, $attribute);
</ins><span class="cx">         push(@$hashSpecials, $special);
</span><span class="cx"> 
</span><span class="cx">         my $getter = GetAttributeGetterName($interfaceName, $className, $interface, $attribute);
</span><span class="lines">@@ -2157,6 +2173,29 @@
</span><span class="cx">         push(@implContent, &quot;    : $parentClassName(vm, structure, WTFMove(impl), shell)\n&quot;);
</span><span class="cx">         push(@implContent, &quot;{\n&quot;);
</span><span class="cx">         push(@implContent, &quot;}\n\n&quot;);
</span><ins>+
+        push(@implContent, &quot;void ${className}::finishCreation(VM&amp; vm, JSDOMWindowShell* shell)\n&quot;);
+        push(@implContent, &quot;{\n&quot;);
+        push(@implContent, &quot;    Base::finishCreation(vm, shell);\n\n&quot;);
+        # Support for RuntimeEnabled attributes on DOMWindow.
+        foreach my $attribute (@{$interface-&gt;attributes}) {
+            next unless $attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;EnabledAtRuntime&quot;};
+
+            AddToImplIncludes(&quot;RuntimeEnabledFeatures.h&quot;);
+            my $conditionalString = $codeGenerator-&gt;GenerateConditionalString($attribute-&gt;signature);
+            push(@implContent, &quot;#if ${conditionalString}\n&quot;) if $conditionalString;
+            my $enable_function = GetRuntimeEnableFunctionName($attribute-&gt;signature);
+            my $attributeName = $attribute-&gt;signature-&gt;name;
+            push(@implContent, &quot;    if (${enable_function}()) {\n&quot;);
+            my $getter = GetAttributeGetterName($interfaceName, $className, $interface, $attribute);
+            my $setter = IsReadonly($attribute) ? &quot;nullptr&quot; : GetAttributeSetterName($interfaceName, $className, $interface, $attribute);
+            push(@implContent, &quot;        auto* customGetterSetter = CustomGetterSetter::create(vm, $getter, $setter);\n&quot;);
+            my $jscAttributes = GetJSCAttributesForAttribute($interface, $attribute);
+            push(@implContent, &quot;        putDirectCustomAccessor(vm, vm.propertyNames-&gt;$attributeName, customGetterSetter, attributesForStructure($jscAttributes));\n&quot;);
+            push(@implContent, &quot;    }\n&quot;);
+            push(@implContent, &quot;#endif\n&quot;) if $conditionalString;
+        }
+        push(@implContent, &quot;}\n\n&quot;);
</ins><span class="cx">     } elsif ($codeGenerator-&gt;InheritsInterface($interface, &quot;WorkerGlobalScope&quot;)) {
</span><span class="cx">         AddIncludesForTypeInImpl($interfaceName);
</span><span class="cx">         push(@implContent, &quot;${className}::$className(VM&amp; vm, Structure* structure, Ref&lt;$implType&gt;&amp;&amp; impl)\n&quot;);
</span><span class="lines">@@ -2340,12 +2379,7 @@
</span><span class="cx"> 
</span><span class="cx">             # Global constructors can be disabled at runtime.
</span><span class="cx">             if ($attribute-&gt;signature-&gt;type =~ /Constructor$/) {
</span><del>-                if ($attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;EnabledAtRuntime&quot;}) {
-                    AddToImplIncludes(&quot;RuntimeEnabledFeatures.h&quot;);
-                    my $enable_function = GetRuntimeEnableFunctionName($attribute-&gt;signature);
-                    push(@implContent, &quot;    if (!${enable_function}())\n&quot;);
-                    push(@implContent, &quot;        return JSValue::encode(jsUndefined());\n&quot;);
-                } elsif ($attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;EnabledBySetting&quot;}) {
</del><ins>+                if ($attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;EnabledBySetting&quot;}) {
</ins><span class="cx">                     AddToImplIncludes(&quot;Frame.h&quot;);
</span><span class="cx">                     AddToImplIncludes(&quot;Settings.h&quot;);
</span><span class="cx">                     my $enable_function = ToMethodName($attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;EnabledBySetting&quot;}) . &quot;Enabled&quot;;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoreinspectorInspectorIndexedDBAgentcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp (204823 => 204824)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp        2016-08-23 12:30:41 UTC (rev 204823)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp        2016-08-23 12:53:59 UTC (rev 204824)
</span><span class="lines">@@ -494,7 +494,7 @@
</span><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    IDBFactory* idbFactory = DOMWindowIndexedDatabase::indexedDB(domWindow);
</del><ins>+    IDBFactory* idbFactory = DOMWindowIndexedDatabase::indexedDB(*domWindow);
</ins><span class="cx">     if (!idbFactory)
</span><span class="cx">         errorString = ASCIILiteral(&quot;No IndexedDB factory for given frame found&quot;);
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>